Working Student / Intern: Offensive Security Engineer (Red Team & AppSec) (f/m/x)

**Cologne, Germany (Hybrid)**

**Team:** Engineering · **Reports to:** CTO · **Format:** Working Student (16–20h/week) or Internship (3–6 months)

**Join our red team**

ilert is a SaaS platform for alerting, on-call management and incident response that keeps digital services always on. Teams worldwide rely on us to stay up.

To keep it that way, we are building an **internal red team** that continuously tests our own products the way a real attacker would. And we're a genuinely interesting target: an attacker who silences ilert doesn't just steal data — they turn off the alarm while they work.

As a working student on our red team, you help us **find, prove, and get security issues fixed** in our own systems. You learn to think like an attacker, working closely with our team.

You don't need to arrive as a finished pentester. You need curiosity, a habit of taking things apart to understand them, and the care to handle what you find responsibly.

Tasks

-----

• **Test Our Apps and APIs:** Hunt for vulnerabilities in our web and mobile apps and APIs — from authentication and access control (IDOR) to injection, misconfigurations, and exposed secrets.
• **Re-test Past Findings:** Go back over findings from previous penetration tests and verify the fixes actually hold.
• **Automate Security Checks in CI:** Help build secret, dependency, and code scanning into our pipelines so issues surface early instead of late.
• **Review New Features Before They Ship:** Support security reviews as features are being built, not after.
• **Run Authorized Social Engineering:** Design and run phishing and pretexting exercises against our own team — always under a written scope signed off by the CTO beforehand, always debriefed as a learning exercise, never punitive. Then help us fix what the exercise exposed.
• **Poke at the AI:** We're building an AI SRE that investigates incidents and can execute actions on approval. Prompt injection, tool abuse, and agent-boundary testing are wide-open ground.
• **Document and Follow Through:** Write up findings clearly and reproducibly, then follow them through to a fix. We care as much about closing the gap as finding it.

What you bring

--------------

• **Enrolled student**, ideally in computer science, IT security, or similar.
• **Genuine interest in offensive security** — you tinker, you break things to understand them, maybe you already play CTFs / Hack The Box / TryHackMe.
• **Basic grasp of how web apps and HTTP work** — requests, headers, auth, cookies/tokens.
• **Comfortable on the command line** and with at least one scripting language (Python, JS/TS, Go).
• **Careful and responsible with sensitive information.** This role comes with access and trust: you stay inside the agreed scope and handle what you find responsibly.
• **Fluent English** (our working language).
• **Able to be in our Cologne office regularly** — the role is hybrid, not remote.

**Bonus**

• Burp Suite or OWASP ZAP
• OWASP Top 10
• AWS / Kubernetes / CI-CD exposure
• Mobile app testing
• LLM and agent security — prompt injection, tool-use boundaries
• Your own CVEs or bug-bounty reports
• German language skills

Benefits

--------

• 🎯 **A Real Attack Surface:** Not a lab, not a CTF box. Production software that companies worldwide depend on during their worst moments.
• 🧨 **Get In Early:** The red team is being built right now. You're not inheriting someone else's checklist — you help shape how we do this.
• 🤖 **Unexplored Ground:** Agentic AI security is barely a discipline yet. You'd be doing original work on it, on a product that's actually shipping.
• 🏡 **Hybrid Freedom:** Our office in **Cologne Rheinauhafen** (3 days/week) plus work from home (2 days/week).
• 🕒 **Student-Centric:** Flexible hours around lectures and exam periods.
• 🎓 **Direct Mentorship:** You report to the CTO and work alongside experienced engineers who want to be shown where they got it wrong.
• 🌴 **Focus Culture:** We protect maker time, favor async, and keep meetings rare.

**We hire for curiosity and a builder's mentality, not a checklist.** If you have a writeup, a CTF profile, a disclosed vulnerability, or a tool you built — bring it. But if you're early and hungry and can show us something you took apart, we want to hear from you too.

_Keywords: Werkstudent IT-Security, Penetration Testing, Praktikum Cyber Security, Red Team, Application Security, Köln._